Description
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hulupeep | mcp-ui-probe | 0.1, 0.2.0 | — |
References
- VDB-387013 | Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal vdb-entry technical-description
- VDB-387013 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-19270 | CVE Analysis and Report third-party-advisory
- Submit #865223 | Hulupeep mcp-ui-probe mcp-ui-probe Path Traversal third-party-advisory
- https://github.com/Hulupeep/mcp-ui-probe/issues/1 issue-tracking
- https://github.com/Hulupeep/mcp-ui-probe/ product